[Mesa-dev] [PATCH] st/va: Fix stray index in suface_from_external_memory()

[Paul Parsons]

The VASurfaceAttribExternalBuffers structure contains a four element array
of pitches, one for each plane. suface_from_external_memory() indexes into
this array using a passed in index, which is in the range 0 to
num_surfaces-1. num_surfaces is the number of surfaces, not planes.
Consequently the indexing is incorrect and will overflow the array.

Since suface_from_external_memory() has already checked that the number of
planes is 1 (line 553), the only valid index into pitches[] is 0.

Signed-off-by: Paul Parsons <lost.distance at yahoo.com>
---

diff -ru a/src/gallium/state_trackers/va/surface.c b/src/gallium/state_trackers/va/surface.c
--- a/src/gallium/state_trackers/va/surface.c	2017-12-08 13:49:11.000000000 +0000
+++ b/src/gallium/state_trackers/va/surface.c	2017-12-17 13:02:36.395911318 +0000
@@ -571,7 +571,7 @@
    memset(&whandle, 0, sizeof(struct winsys_handle));
    whandle.type = DRM_API_HANDLE_TYPE_FD;
    whandle.handle = memory_attibute->buffers[index];
-   whandle.stride = memory_attibute->pitches[index];
+   whandle.stride = memory_attibute->pitches[0];
 
    resource = pscreen->resource_from_handle(pscreen, &res_templ, &whandle,
                                             PIPE_HANDLE_USAGE_READ_WRITE);